opschain admin github-connections provision-webhook
integrations:github
Provisions GitHub webhook ingestion for a connection: one signed
inbound-webhook connection on the generic inbound lane — deliveries
POST to /api/hooks/github-<code>, authenticated by their
X-Hub-Signature-256 HMAC signature, deduplicated on GitHub's delivery
id, and executed (when a trigger matches) as the named service account.
There is no second inbound endpoint: GitHub rides the same lane
opschain admin inbound-webhooks manages, and the provisioned
connection remains manageable there (rotate its secret, change its
rate, disable it).
The signing secret is write-only. Supply the one your GitHub App
webhook is configured with via --secret-env or --secret-prompt
(never on the command line) — or supply none and a strong secret is
generated and printed exactly once, ready to paste into the App's
webhook configuration. It is never readable again.
A verified delivery lands as one external:webhook:received event with
the raw payload under data.payload and, for the common GitHub events
(push, pull_request, workflow_run, release), a normalised typed
field set under data.github (repository, ref, sha, action,
conclusion…) for trigger conditions. Provisioning requires the
integrations:github entitlement and is refused by name when the
connection already has ingestion provisioned.
opschain admin github-connections provision-webhook corp-github \
--service-account gha-payments
Provisioned GitHub webhook ingestion for corp-github as inbound connection github-corp-github
Point the GitHub App's webhook at <server URL>/api/hooks/github-corp-github
Signing secret (shown ONCE - paste it into the App's webhook configuration): 4f1e…
Flags
| Flag | Meaning |
|---|---|
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
--service-account <username> | The service account every trigger firing a delivery causes executes as (required). |
--secret-env <name> | Environment variable holding the webhook signing secret (never the value itself on argv; omit the secret flags to have one generated). |
--secret-prompt | Prompt for the webhook signing secret without echo. |
--replay-window <seconds> | Replay window, 30–86400 (0: 300, the lane default). |
--rate-per-minute <n> | Per-minute request budget: 1–6000 for the connection's own budget, 0 (the default) inherits the estate default webhooks.default_rate_per_minute (itself unset = 60), -1 is unlimited at this connection (pass it as --rate-per-minute=-1). |
See also
opschain docs cli/admin-inbound-webhooks— managing the provisioned connection (secret rotation, rate, enablement).opschain docs integrations-github— the integration end to end, webhook triggers included.